Privacy Notice - Hong Kong

What is this notice about?

Interpath (“Interpath Advisory”, “we”, “us”, “our”) is dedicated to protecting the confidentiality and privacy of information entrusted to us in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (“GDPR”), the GDPR as it applies in the United Kingdom (“UK GDPR”), the UK Data Protection Act 2018, and all other applicable data protection laws in the territories in which we operate.

This Privacy Notice sets out how we process information about you (referred to as “personal data” within this Privacy Notice), including how we collect and use this personal data and your rights in relation to this personal data. This Privacy Notice is supplemented with specific information relating to each country in which we operate. Please see the relevant Country-Specific Information section below for this information.

This Privacy Notice applies to you if you are:

- a visitor to any of our websites;

- a visitor to any of our offices;

- a subscriber to our newsletter or recipient of any other marketing communications;

- a business contact or prospective business contact, or an employee of such a contact;

- an attendee at an event, meeting or webinar hosted by us; and/or

- are otherwise provided with a copy of or link to this Privacy Notice.

Who are we and how can you contact us?

Interpath is a global group of companies providing professional financial advisory services across deals, advisory and restructuring. The precise Interpath entity responsible for the processing of your personal data will depend on which of our offices you are engaging with. Details of the relevant Interpath entities and their details can be found here; https://interpath.com/locations/

If you have questions or comments about this Privacy Notice or how we handle personal data or wish to complain to us about our handling of your personal data, please contact the Global Privacy Office via dataprivacy@interpath.com.

Personal data we collect and why

Applicable data protection laws require us to inform you about the purposes for which we use your personal data. In some territories, we are also required to have, and to inform you of, the legal basis we rely upon for such use. 'Legal bases' are the legal reasons for our use of your personal data – these are set out in applicable data protection laws. If your territory requires us to have a legal basis, we cannot use your personal data if we do not have a valid legal basis for such use.

We process the following types of personal data, which we collect directly from you when you visit our websites, complete our online forms, subscribe for our newsletter or other marketing communications, provide us with your business card, attend our events, meetings or webinars, visit our offices, perform services for us or otherwise interact with us:

Category of personal data

Purpose of processing

Legal basis for processing (only applicable in those territories that require us to have a legal basis)

Category of personal data	Purpose of processing	Legal basis for processing (only applicable in those territories that require us to have a legal basis)
Contact details (Name, company name, job title, work and personal telephone numbers, work and personal email address, postal address)	To respond to you when you complete our online forms or send us a request for a proposal, tender or quotation	Legitimate interests For our legitimate interest in growing our business
	To contact you in relation to our events, meetings or webinars, including to send invitations and providing access to such events, meetings and webinars	Legitimate interests For our legitimate interest in operating successful events, meetings and webinars as part of our ongoing business
	Promoting our professional services, products and capabilities, including via our newsletter and other marketing communications	Consent Where legally required, we ask for your consent when you sign up for our newsletter or other marketing communications. You can withdraw this consent at any time by unsubscribing using the button at the bottom of our emails to you or as otherwise described in the communication
		Legitimate interests For our legitimate interest in keeping you informed about our business offering and wider market information
	To contact you in relation to services you provide to us	Legitimate interests For our legitimate interest in communicating with you to receive business services required for the operation and administration of our business
	To contact you in relation to services you provide to us	Performance of a contract with you For the performance of a contract with you for the provision of business services to us
Device and web data (IP address, traffic data, clickstream information, time stamp, location data, web logs, other communication data such as your browser type and version, time zone setting and location, plug-in types and versions, operating system and platform; and the resources that you access)	Administering, maintaining and ensuring the security of our information systems, applications and websites	Consent We collect this information using cookies. Where legally required, we obtain your prior consent to the dropping of cookies and the processing of personal data collected via those cookies. For further information about our use of cookies, please refer to our cookies policy at https://interpath.com/policies-and-regulatory-information/hong-kong/cookie-policy/
		Legal obligation If we are not legally required to obtain your consent to the use of cookies, we will process any personal data collected from those cookies to comply with our legal and regulatory obligations relating to fraud and cyber crime and to protect personal data
		Legitimate interests If we are not legally required to obtain your consent to the use of cookies, we will process any personal data collected from those cookies on the basis that it is in our legitimate interest in ensuring the safety and security of our website and preventing unauthorised access to our IT systems and websites
	Personalise online landing pages and communications we think would be of interest based on interactions with us.	Consent We collect this information using cookies. Where legally required, we obtain your prior consent to the dropping of cookies and the processing of personal data collected via those cookies. For further information about our use of cookies, please refer to our cookies policy at https://interpath.com/policies-and-regulatory-information/hong-kong/cookie-policy/
		Legitimate Interest If we are not legally required to obtain your consent to the use of cookies, we will process any personal data collected from those cookies on the basis that it is in our legitimate business interest to ensure we provide you with relevant information in order to encourage you to use our services.
CCTV (Images and videos of visitors to our offices)	To ensure the physical safety and security of our sites by monitoring access and detecting and preventing crime	Legitimate interests For our legitimate interest in ensuring the safety and security of our sites
Incident data (Contact details, incident report, first aider report, witness statements and CCTV)	To comply with health and safety legislation when a visitor to our office has an accident	Legal obligation To comply with health and safety legislation we are required to record such incidents
Children’s data (name, age, name of parents or guardians, dietary requirements)	For building security and catering purpose as events they attend	Legitimate interest For our legitimate interest in operating safe and successful events.

We process the following types of personal data, which we collect from public sources, including public registers (such as Companies House), news articles, sanctions lists, government intelligence and crime prevention agencies, and internet searches:

Category of personal data

Purpose of processing

Legal basis for processing (applicable in those territories that require us to have a legal basis)

Contact details (Name, company name, job title, work and personal telephone numbers, work and personal email address, postal address)

Contacting you as a journalist regarding company press releases, invitations to annual press parties, highlighting messages that may be of interest on specific industry topics

Legitimate interests

For our legitimate interest in promoting and publicising our business.

Professional details (Job and career history, educational background, professional memberships, published articles)

General marketing and press release purposes.

Legitimate interests

For our legitimate interest in promoting and publicising our business.

We process the following types of personal data, which we collect from social and professional networking sites if you register or login to our websites using social media (e.g., LinkedIn):

Category of personal data

Purpose of processing

Legal basis for processing (applicable in those territories that require us to have a legal basis)

Contact details (Name, company name, job title, work and personal telephone numbers, work and personal email address, postal address – the specific categories are those that you permit the social or professional networking site to share with us)

To authenticate your identity and connect your professional and social media network login information with us

Legitimate interests

For our legitimate interest in providing you with the method of logging on to our website that you have requested

Do we share personal data with third parties?

We occasionally share personal data with trusted third parties to help us deliver efficient and quality services. These recipients are either contractually bound or bound by law to safeguard the data we entrust to them. We engage with the following categories of recipients:

Parties that support us as we provide our services (e.g., providers of telecommunication systems, mailroom support, IT system support, archiving services, document production services and cloud-based software services).
Our professional advisers, including lawyers, agents, auditors, health & safety advisors and insurers.
A potential buyer, transferee, merger partner or seller and their advisers in connection with an actual or potential transfer or merger of part or all of our business or assets, or any associated rights or interests, or to acquire a business or enter into a merger with it.
Law enforcement or other government and regulatory agencies (e.g., HMRC) or to other third parties as required by, and in accordance with, applicable law or regulation.
Payment, marketing and recruitment services providers.
Our employees, sub-contractors, agents or service providers who work for us where required or necessary for the performance of their duties and in line with the reasons for processing set out in this Privacy Notice.

Do we transfer your personal data outside your country of residence?

We have servers in the United Kingdom, Europe, Australia and Canada. We may transfer personal data within the Interpath group of companies or to reputable third-party organisations situated outside the country in which your personal data is stored when we have a business reason to engage these organisations. We only transfer your personal data outside the country in which we have offices where we are satisfied that the transfer complies with local data protection law and, if legally required, appropriate safeguards are in place to ensure that your personal data is subject to safety measures equivalent to those in the country in which it is stored.

What are your data protection rights?

Depending on your location, you may have some or all of the following rights in relation to your personal data, subject to certain limitations and exceptions:

Access – You can ask us to verify whether we are processing personal data about you, and if so, to provide more specific information.
Correction – You can ask us to correct our records if you believe they contain incorrect or incomplete information about you.
Erasure – You can ask us to erase (delete) your personal data after you withdraw your consent to processing or when we no longer need it for the purpose it was originally collected. In most cases, this right will not apply where we process your personal data pursuant to our legal obligations.
Processing restrictions – You can ask us to temporarily restrict our processing of your personal data if you contest the accuracy of your personal data, prefer to restrict its use rather than having us erase it, or need us to preserve it for you to establish, exercise, or defend a legal claim. A temporary restriction may apply while verifying whether we have overriding legitimate grounds to process it. You can also ask us to inform you before we lift that temporary processing restriction.
Data portability – Where you have provided personal data to us, you can ask us to transmit that personal data (in a structured, commonly used, and machine-readable format) directly to another company if it is technically feasible. This right is only available in relation to personal data that we process with your consent or where this is necessary for the performance of a contract with you, and such processing is carried out by automated means.
Right to object – You can object to our use of your personal data for direct marketing purposes, including profiling, at any time. We may need to keep some minimal information to comply with your request to cease marketing to you. You can also object to our use of your personal data where our processing is necessary for us to pursue a legitimate interest (in those territories where we need a legal basis for processing).
Right to withdraw consent – You can withdraw your consent that you have previously given to one or more specified purposes to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. It may mean we are not able to provide certain products or services to you and we will advise you if this is the case. This right is only available in relation to personal data that we process with your consent.
Right to lodge a complaint – You can lodge a complaint with the relevant data protection supervisory of your country if you believe your rights have been infringed. Please see the relevant Country-Specific Information section set out at Appendix 2 below for details of the relevant data protection supervisory in your country.

Please note that the availability and scope of these rights may vary depending on the office with which you engage. If you have a question about your data protection rights or would like to exercise your data subject rights, you can email your local Interpath entity using dataprivacy@interpath.com.

How long do we retain your personal data?

We retain personal data to provide our services, stay in contact with you and to comply with applicable laws, regulations, and professional obligations that we are subject to. Unless a different time frame applies as a result of business need or specific legal, regulatory or contractual requirements, where we retain personal data in accordance with these purposes, we retain such personal data for seven years.

Do we link to other websites?

Please be aware that our websites may contain links to other sites, including sites maintained by third parties that are not governed by this Privacy Notice. Please review the destination websites’ privacy notices before submitting personal data on those sites. Whilst we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content, security, or privacy practices employed by other sites.

Do we change this Privacy Notice?

We regularly review this Privacy Notice and will post any updates to it on this webpage. All amendments will automatically take effect immediately on posting. Please check this Privacy Notice periodically to inform yourself of any changes.

This Privacy Notice was last updated in November 2025.

COUNTRY-SPECIFIC INFORMATION

Bermuda – Additional Information

Privacy Officer

Contact details of our Privacy Officer for Bermuda are:

Email: dataprivacy@interpath.com

Contact details of our PIPA Privacy Officer for Bermuda are:

Ali Wisbey

Email: dataprivacy@interpath.com

Complaints

The contact details for the appropriate data protection supervisory is as follows:

- Bermuda:

o The Office of the Privacy Commissioner for Bermuda

Email: privcom@privacy.bm

Post: Maxwell Roberts Building, 4th Floor, 1 Church Street, Hamilton, HM11, Bermuda

Website: https://www.privacy.bm/

Telephone: 1-441-543-7748

British Virgin Islands – Additional Information

Legal basis for processing

Under the data protection laws of the British Virgin Islands, we are unable to rely on our legitimate interests as a legal reason for processing your personal data. Where "legitimate interest" is referred to in the table under Personal data we collect and why, this shall be replaced with your consent as our legal reason for processing your personal data.

Complaints

The contact details for the appropriate data protection supervisory is as follows:

- British Virgin Islands:

o BVI Information Commissioner:

Email: gis@gov.vg

Post: 33 Admin Drive, Wickhams Cay 1, Road Town, Tortola, British Virgin Islands

Website: https://bvi.gov.vg/departments/office-complaints-commission

Telephone: 1284468701

Cayman Islands – Additional Information

Complaints

The contact details for the appropriate data protection supervisory is as follows:

- Cayman Islands:

o Ombudsman Cayman Islands:

Email: info@ombudsman.ky

Post: PO Box 2252, Grand Cayman KY1-1107, CAYMAN ISLANDS

Website: https://ombudsman.ky/data-protection

Telephone: +13459466283

European Union and United Kingdom – Additional Information

Data Protection Officer

In addition to the contact details set out above, any questions about this Privacy Notice or complaints about how we handle your personal data may be directed to our Data Protection Officer using the email address: dataprivacy@interpathadvisory.com.

International transfers

To the limited extent that it is necessary to transfer personal data outside of the UK or the EEA, we will ensure appropriate safeguards are in place to protect the privacy and integrity of such personal data, including standard contractual clauses under Article 46.2 of the GDPR (and the equivalent standard contractual clauses for the UK, where appropriate) or an adequacy decision under Article 45 for the GDPR. Please contact us using the contact details set out in the Who we are and how can you contact us? section above if you wish to obtain further information concerning the safeguards we put in place, including copies of the standard contractual clauses entered into with any third parties based outside of the UK or EEA to whom we transfer personal data to.

Data Protection Rights

In relation to the personal data that we collect, and process as detailed in this Privacy Notice and to which the EU GDPR or UK GDPR applies, you have the right to:

Right to decide the fate of personal data on death (in France only): You have the right to define general or specific instructions relating to the retention, erasure, and disclosure of your personal data after your death. You may modify or delete these instructions at any time by contacting us using the information on the table above.
Right to complain to the controller (in UK only): You have the right to make a complaint to the controller if the controller is not complaint with Data Protection Legislation or if you consider that there has been an infringement of Data Protection Legislation.

For further information about your data protection rights under EU GDPR and UK GDPR, see here: https://ico.org.uk/for-the-public/

Complaints

You also have a right to lodge a complaint to an appropriate data protection supervisory authority about the manner in which we handle your personal data. The contact details for the appropriate data protection supervisory authorities are as follows:

- United Kingdom:

o Information Commissioner’s Office

Email: casework@ico.org.uk

Post: Water Lane, Wycliffe House Wilmslow, Cheshire SK9 5AF, United Kingdom

Website: https://ico.org.uk

Telephone: 03031231113

- Republic of Ireland:

o Data Protection Commission:

Webform: https://forms.dataprotection.ie/contact

Post: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

Website: https://www.dataprotection.ie/

Telephone: 017650100